1f97895f155ba863e1c57562cdb17b79b3c1db3d1e210649827fea8d8147a0ce

Analysis

max time kernel
138s
max time network
266s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
09-11-2023 13:17

Target

Payment_Advice.exe
Size

3.0MB
MD5

004dfc0b2894f71a6e580bf96e847ccb
SHA1

bce881adac787b1c3171e2c4cffbd01d8748ef58
SHA256

c97ce3037f229baa9cd97ab732a4363f8d7f6cf3ebc3062ce4973414c0b1ce77
SHA512

492e12c036e62b5f5a5b460318d94c23c2059ed45cfb5d76687ac3887f05f671712f97cbf387199a25d13ed90c71438b5b8b8b83146314dc76c1cb4f67745e79
SSDEEP

98304:7ajJxZ942KQV9hp4jcdwr2dddddcdtlIdS9ddd/ndgRgHzdBG3tddNfmP/SA8:mtZ4mVJ+cdwr2dddddcdtlIdS9ddd/nG

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

Payment_Advice.exe

pid process

4860 Payment_Advice.exe
4860 Payment_Advice.exe
4860 Payment_Advice.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Payment_Advice.exe

description	pid	process	target process
PID 4860 wrote to memory of 3940	4860	Payment_Advice.exe	cmd.exe
PID 4860 wrote to memory of 3940	4860	Payment_Advice.exe	cmd.exe
PID 4860 wrote to memory of 3940	4860	Payment_Advice.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\Payment_Advice.exe
"C:\Users\Admin\AppData\Local\Temp\Payment_Advice.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:3940

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact